CVE-2025-55182 Security Details

CVE ID

CVE-2025-55182

CWE

CWE-502

CVE Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Published

Dec 3, 2025

CVSS Score & Severity

9.3Critical

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS Score

82.011%

Malware

malware

KEV Status

Known Exploited

Vulnerable Methods

anon{13,3,1482e2f,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,2dfbed9,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,3aefddd,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,7004b11,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,7fbb644,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,80453a9,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,88ed666,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,9cb4995,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,caf80b0,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,da4b780,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,ddf83f6,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,de912a5,f}/getOutlinedModel()

JSVulnerable params: 1

anon{13,3,f403f81,f}/getOutlinedModel()

JSVulnerable params: 1

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · ejpir/CVE-2025-55182-researchATTACK

GitHub · lachlan2k/React2Shell-CVE-2025-55182-original-pocATTACK

GitHub · facebook/reactPROJECT

react.devPROJECT